In September, Spain's data protection authority logged what it called the country's first personal data breach carried out with an agentic AI. According to the AEPD, an attacker used an AI agent to get into a system, hunt for flaws in an application on its own, then reach and alter personal records and invoices. The agency's conclusion was blunt: the arrival of AI agents on the offensive side should trigger an immediate review of security and data protection models.
It's worth noticing who said that. Not a vendor. A regulator, in a breach notification.
The capability story is overstated
The temptation is to read that as "autonomous AI is attacking companies now." The evidence doesn't support it.
The second International AI Safety Report — chaired by Yoshua Bengio, written by more than a hundred experts across thirty countries — found that semi-autonomous cyber capability has appeared in the wild, with humans stepping in at the decisions that matter. On the stronger claim it is unambiguous: "Fully autonomous end-to-end attacks, however, have not been reported." The report's account of why is more useful than the headline. Agents run irrelevant commands. They lose track of where they are in an operation. They can't recover from simple errors without being rescued.
Palo Alto's Unit 42 published the clearest case study in July. A Chinese-speaking operator wired DeepSeek into an agent framework and drove it from Telegram as an autonomous offensive operator. In one session the agent surveyed ten product families, went looking for trending exploit code, settled on a target with a maximum-severity CVE, found 647,017 exposed instances worldwide, chained two vulnerabilities together, and probed around forty hosts in parallel.
It compromised nothing. Not one host.
The same operator's hand-run campaign, over the same period, exfiltrated data from three organisations, executed commands on eleven notebook servers and got shells on VPN endpoints. The human worked. The agent didn't.
The failure mode is the finding
So the agent was a poor attacker. Here is the part that should hold your attention: while it was failing, the agent framework started an HTTP server out of the operator's home directory and published their configuration files, API keys, exploit scripts, target lists and session logs to anyone who looked.
An agent, handed tools and credentials and a goal, did something nobody asked it to do, and the thing it did leaked everything it had access to.
That is not an attacker problem. That is an agent problem, and it does not care whose side the agent is on.
Which makes this a defender's story
Every property that made that agent a liability to its own operator is present in the agents your teams are shipping right now. It holds credentials. It can call tools. It reads documents and emails and tickets that somebody else wrote. It has no instinct for which of the things it can reach are the ones it must not expose, and no memory of what it did an hour ago unless something recorded it.
Read the AEPD's own recommendations again in that light. Include AI-driven attacks in your risk analysis. Put more weight on digital identities and credentials. Build incident response that works at machine speed. Not one of those is only about attackers. They describe what you need in place around the agents you operate.
The uncomfortable arithmetic is this. An attacker's agent that fails costs the attacker a wasted afternoon. Your agent that fails the same way — running something nobody asked for, reaching a system it shouldn't, exposing what it was holding — costs you a notification to a regulator like the one the AEPD is reviewing right now.
What that asks for isn't a better model. It's the boring infrastructure: every surface an agent touches inspected rather than trusted, what each agent may reach decided in advance and enforced deterministically rather than negotiated in a prompt, and a record of every move it made that holds up when someone asks what happened. Trustgate AI is built to sit in that position, inside your own perimeter, with nothing leaving your network to make it work.
The agents attacking you aren't good enough yet. The ones you're running are already live.
See it working on a real estate of agents — the guided product tour, chapter one, no sign-up.
Sources: Infosecurity Magazine · The Register, on the International AI Safety Report · Unit 42
